JCM (nprofile…66dp)
Ed25519
All known FEP-8b32 implementers support EdDSA in embedded signatures:
https://codeberg.org/fediverse/fep/src/branch/main/fep/8b32/fep-8b32.md#implementations
Some of them may support EdDSA in HTTP signatures too.
What happens if my instance only does Ed25519 signing and another instance does not support it?
The authentication will fail, but in theory recipients can try to authenticate activity by fetching it by its id.
Can I use the same key pair for all users on my instance?
Yes, but that increases damage in case of a key compromise.
Is there a functional difference between using an instance actor or the admin user for Authorized Fetch signatures?
Depends on what resource you're trying to access. If the resource is private, such as a direct message to admin, only the admin actor will be able to access it.
If I don't want to implement an Outbox (since it seems like the Fediverse has moved away from it), does my endpoint for it still need to exist?
The outbox property is required on actors but the endpoint is optional.
The Fediverse doesn't actually move away from it, the outbox is used for backfilling.
What is the worst thing a bad actor could do if my account's private key is compromised?
Impersonate you, and all users on your server if the secret key is shared.
silverpill
npub1df…27gmw
2026-06-26 12:47:09 UTC
in reply to nevent1q…svec
Author Public Key
npub1df0nthpgzfmvxrzj0cfypmmt45l0y770j260auqhm3l45hp3uhkqx27gmwSeen on
wss://relay.ditto.pubPublished at
2026-06-26 12:47:09 UTCEvent JSON
{
"id": "9c7a6eb0861bad5f37b76aad21d3c007faeeaa6fd6b180d61d98bfea0bec7213",
"pubkey": "6a5f35dc281276c30c527e1240ef6bad3ef27bcf92b4fef017dc7f5a5c31e5ec",
"created_at": 1782478029,
"kind": 1,
"tags": [
[
"p",
"744bd71792923812aaae079ced7f237c8cde71fa6a3c0605d301391aad0e52e5",
"wss://relay.ditto.pub"
],
[
"e",
"74eaf8bbfe59a95585f6b4dac42234c2b9c0e868c4e676bb8743d181860476e1",
"wss://relay.ditto.pub",
"reply"
],
[
"proxy",
"https://mitra.social/objects/019f03f8-4174-7461-993d-f26384bda016",
"activitypub"
],
[
"client",
"Mostr",
"31990:6be38f8c63df7dbf84db7ec4a6e6fbbd8d19dca3b980efad18585c46f04b26f9:mostr",
"wss://relay.ditto.pub"
]
],
"content": "nostr:nprofile1qy2hwumn8ghj7un9d3shjtnyd968gmewwp6kyqpqw39aw9ujjgup924wq7ww6ler0jxduu06dg7qvpwnqyu34tgw2tjsl066dp\n\nEd25519\n\nAll known FEP-8b32 implementers support EdDSA in embedded signatures:\nhttps://codeberg.org/fediverse/fep/src/branch/main/fep/8b32/fep-8b32.md#implementations\n\nSome of them may support EdDSA in HTTP signatures too.\n\nWhat happens if my instance only does Ed25519 signing and another instance does not support it?\n\nThe authentication will fail, but in theory recipients can try to authenticate activity by fetching it by its id.\n\nCan I use the same key pair for all users on my instance?\n\nYes, but that increases damage in case of a key compromise.\n\nIs there a functional difference between using an instance actor or the admin user for Authorized Fetch signatures?\n\nDepends on what resource you're trying to access. If the resource is private, such as a direct message to admin, only the admin actor will be able to access it.\n\nIf I don't want to implement an Outbox (since it seems like the Fediverse has moved away from it), does my endpoint for it still need to exist?\n\nThe outbox property is required on actors but the endpoint is optional.\n\nThe Fediverse doesn't actually move away from it, the outbox is used for backfilling.\n\nWhat is the worst thing a bad actor could do if my account's private key is compromised?\n\nImpersonate you, and all users on your server if the secret key is shared.",
"sig": "9682cb1f2956fa9967cc37c5faa52d31a3df09089aabeead6c4569cbf60348cacc3d765d34deed4b77a259fdef3db0bdf5c8596c7fa571a3cc34f4d228f7a1aa"
}